Trojan Horse

9

Blake led Jeff out of the building with relief, mentioning that he still had a forty-five-minute drive home ahead of him. Meanwhile, Yates had booked Jeff into a boutique hotel just down the street, the Royal Arms, a converted Victorian mansion, which specialized in discretion. As he walked to the hotel, Big Ben pealed just down the river from Whitehall. A light fog drifted through the quiet streets, reminding Jeff of a Sherlock Holmes story.

The events of this last decade had only served to impress upon Jeff the increasing danger of the cyber world. Computers were under relentless and ever more effective attack, if not from some juvenile hacker looking to claim bragging rights, then from Russian mobsters phishing penetrations seeking financial information, Eastern European gangs out to blackmail companies through denial-of-service attacks, or the ongoing Chinese government campaign to gain security access and information in the West.

It was a never-ending battle, one that demanded increasing sophistication and proactive measures to effectively counter. The usual antivirus security companies that provided firewalls and scans were constantly playing catch up as they responded to each new attack only after it was launched and discovered. Though doing a reasonably effective job, they were essentially counterpunching. All kinds of malware made it into countless computers before being discovered and before a protective patch was prepared, then distributed. His latest client was just such an example.

Worse, the sophisticated tools needed to create malware were commonly available on the Internet. Any geek with basic malware knowledge could download components and cobble together a virus or Trojan, and many did. And now that criminal bands and certain rogue governments were in the malware business for real, the sophistication of each attack was increasing with each passing month.

There were, in general, three varieties of malware: junk malware like “scareware,” malware aimed at stealing money or data to sell, and government espionage including cyber warfare. Such state-directed attacks were ongoing and surprisingly effective.

Valuable data on the U.S. Joint Strike Fighter project, the costliest weapon system ever built, was stolen directly from the Pentagon’s computers. The Air Force’s air-traffic-control system had been penetrated and the intruders downloaded several terabytes of valuable data related to its electronics and design. The Department of Defense’s Secure Internet Protocol Router Network was infected for a time with specially designed software intended to disable the system in time of confrontation or conflict.

In the private sector, the situation was so bad that a major American manufacturer of computers had actually shipped a new product that contained a virus. Infections in iPhones and other cell phones, in every device commonly used in the twenty-first century were increasingly common. Their use for cyber penetration was only a matter of time.

The Royal Arms was nearly beside St. James Park. This part of London was rife with history. He’d like to come here with Daryl someday, when neither of them was on assignment. He wondered if they ever would.

Once in his room Jeff showered then sat in a comfortable chair and despite his exhaustion called Daryl. She sounded glad to hear from him, but then she always did. After he told her what he’d discovered since his e-mail, she briefed him on her examination of the virus code.

“It’s tight, as far as I’ve been able to see to this point. I still have more to do, though,” she said.

The heart, the digital soul so to speak, of the Internet and of computers was software code. Code was the magic that made everything work. Code produced the images, the colors, the words, everything.

Just as there were brilliant painters and amateurs, so it was with code writers. Anyone with a modicum of software knowledge could copy, paste, and modify bits of code. Script kiddies did just that, adding little of their own to the work, often surprised when what they’d cobbled together actually did something. Such junk sat in computers all over the world, sometimes clogging them up, often as not doing nothing but taking up space.

Then there was tight code that did what it was meant to do efficiently, cleanly, and with a minimum of space and fuss. Corporations typically produced such code, sometimes government agencies did as well.

Then there was genius code, code so good, so smooth, so effortless, it was like a brilliant work of art. This wasn’t that good, Daryl told him, but it was very, very good indeed.

When she finished, Jeff said, “The author has really thought this through. When the system shuts down, the virus saves itself to a file with a name identical to one that’s part of the primary antivirus suite used by the UK government, just in a different location.”

“That’s clever of someone,” she said. “So if an administrator were to stumble on it and examine its properties they’d see ones that matched those of a legitimate file.”

If suspicious, an extra check would typically be to verify the digital signature of the file, tamper-proof evidence that confirmed who it was produced by. However, despite the fact that all Windows components were digitally signed by Microsoft and many software vendors signed their software, the antivirus industry ironically had been slow to adopt the practice. The result was that this second check couldn’t be performed in this instance because the author had been clever enough to hide the file in the one place where digital signatures weren’t commonly used.

“The guy’s pretty sneaky,” Daryl said.

Jeff told her that he couldn’t think clearly any longer and was going to bed. “Sleep tight,” she said. He left a wakeup call for five hours later and was asleep at once. In his dreams he chased pixels across a screen, saw images of streaming code, and engaged in conversations with Yates about their virus that had never taken place. When the telephone rang it was as if he’d never left work, never slept at all, he was so weary. He showered, redressed, ate a continental breakfast, then set out for Whitehall.

The early-spring morning was fresh and invigorating. Big Ben pealed again. A bleary-eyed Blake was already in his office and waiting for him. “You look better than yesterday,” he said as he led Jeff into the basement. “I’ll let you get to it.”

“There’s no need for you to keep me company,” Jeff said as he set his bag down. “I know where to reach you.” Blake left, looking relieved.

Jeff picked up his cell phone and sent Daryl a message to let her know he was working. She came back at once. “Worked all day with no luck.” Jeff did a quick mental calculation. It was nearly three in the morning in D.C. “As I told you, this thing is really clean, I mean really clean. Now in the chat rooms.”

Malware creators often bragged about what they’d launched. There were certain chat rooms frequented by such authors and even if they did no crowing personally, it was not unusual for someone familiar with the new virus to chat about it, and the author. This often led to vital clues as it had before when they’d uncovered the Superphreak virus that led them to the Al Qaeda plot.

For Jeff, it was time to determine what the virus did when it went active. Utilizing his debugger again, Jeff focused on the system process hosting the malware parasite. This was a protracted, exhausting process requiring his full attention on the heavily obfuscated malware code. The author had worked hard at making it difficult to analyze. But after several hours Jeff made a key discovery. Every two or three days, after it awakened from its digital slumber, the virus generated a list of a thousand seemingly random DNS names and reached out onto the Internet. DNS, or Domain Name System, is the convention used to give the actual numeric addresses, like 192.168.122.12, human readable aliases, like www.facebook.com. Individuals and companies purchase names from domain-name registrars around the world and the registrars maintain mappings of names to the numeric addresses, called IP addresses, in databases on the Internet that software can reference to perform name translations.

The virus then worked its way through the list it generated, one at a time, again at random intervals lasting anywhere from ten seconds to one minute. The lack of regularity was designed to cause the queries to blend in with the usual network activity in the log files. In each case it was attempting to connect to a specific DNS. The purpose once there, Jeff knew, was to download instructions as to what the virus should do now that it was in the Walthrop computer with access to his files.

This was a technique the author had borrowed from the infamous Conficker virus that first appeared in late 2008. It was especially crafty since the author had to simply activate one address of the thousand listed at approximately the prescribed time and from it, deliver the instructions to the virus. The timing was structured into the malware system.

Antivirus investigators such as Jeff and Daryl, not to mention traditional law enforcement agencies involved in stopping cybercrime, lacked the resources and time to check the registrant of every possible domain name the malware was employing. Worse, it was easy to obtain a domain name under a fictitious or borrowed identity and most of the randomly generated names were in third-world countries, which lacked legal agreements with the Western nations and typically had few cyber laws.

He forwarded the address generation code to Daryl and asked her to research it for patterns when she had time. Maybe the names weren’t as random as they first appeared. It would take hours to devise a way to fool the virus into thinking that the time to generate the domain names had arrived so she could scrutinize them in the meantime. Once that was accomplished she’d analyze the list, looking for signs, for patterns, for anything that would help. But she’d have to sleep soon. He wished she was here, working with him hand in hand.

Authors tried to be clever when designing a virus but they could not avoid leaving clues. Bits and pieces of old code were often cobbled into a new creation and the old code, created or used when the author was green, tended to be sloppier. Jeff and Daryl had once managed to find the street address in Moscow for an author based on just such a clue. She’d had no similar luck earlier with the code itself but Jeff was more hopeful she’d have some success with the address list. There was bound to be a pattern.

During these long hours Jeff observed the malware in detail, identifying new files it duplicated into the computer and locating files that had been modified using a Windows feature that tracked such changes. The virus appeared to be searching only for document files, including presentations and those in OfficeWorks.

This was the heart of what Jeff did. There was no glamour in it, but both he and Daryl shared a passion for the cyber hunt. They were detectives on the trail of the culprit and at any turn of the electronic corner within the computer they might uncover him.

Jeff lost all connection to day or night. Every two hours his watch chirped. He would stop, stand up and stretch, go for a walk in the hallways, find a restroom, and splash water on his face. Back in the office, he would pour a cup of whatever had caffeine in it, often eat something sugary, then return to his digital world.

He hated losing, hated it with an all-consuming passion. And he loved games. For him, uncovering the virus, unraveling how it worked, assessing what damage it had done, was the greatest challenge of all, as real to him at times as playing rugby.

He’d told Daryl once that at times like these the pixels in the computer, the code he read, were his entire world. He could understand how certain personalities became addicted to the cyber universe. As it became even more sophisticated, he occasionally wondered what the future for some people was going to be, locked away in their rooms, utterly lacking any normal contact with humanity, their brains directly wired into the network.

By afternoon Jeff concluded he’d learned all he could at Whitehall and told Blake to arrange a meeting as soon as convenient. He called Daryl, who he reasoned had to be even wearier than he was. She’d been working at very odd hours.

“You awake?” he said.

“Just barely. I’m living on coffee.” She sounded tired. “I called Frank Renkin at the Company to see if he’d put his team on the DNS names. It was a big job.” Frank was a friend of Jeff’s from college where they’d taken a number of classes together. She knew him as well from her work with the CIA. Neither of them had kept in touch particularly but they all worked in the same field and ran into one another from time to time. They also customarily exchanged data they thought the other could find useful. What Daryl liked best was that Frank was happily married and had never made a pass. He’d landed with the CIA, working internal computer security.

“And how is Frank?”

“Very good. A third baby is on the way. They want a boy this time. He seemed a bit stunned at the thought. I don’t think it’s planned.” Jeff laughed. “I called because he represented the government in the Conficker Cabal and might have information on new strains.”

“Right. Our guy’s using the same name-generation technique. Any luck?”

“Nothing off the top of his head,” she said, “but he was glad to get the information. I also forwarded the code to him and he promised to get back as soon as his people compared it to what they have on Conficker. It’s always possible it’s the same author.”

“Yeah. More likely our guy borrowed it.”

“You know, I don’t want to give our author too much credit but this seems to be a very well-thought-out virus. When I stepped through the code I didn’t find a single hint of origin, nothing. It seems like he made a conscious effort to keep it clean. And there was something else. It doesn’t have the feel of a single gifted author. I’d say several people worked on this thing.” She paused. “There was also nothing in the chat rooms. Not a word. This thing’s potential is so great you’d think somebody, somewhere, would be talking about it. It’s as if it was created in a vacuum.”

“Any luck with the DNS names?”

“I’ve just been looking over the results Frank’s team came up with and can’t help notice that the names are heavily biased toward those ending in Iran. In fact, nearly half of them produced by the algorithm fall under the Iranian namespace, ending in.ir.”

“That’s either a very stupid move on the part of an Iranian author,” Jeff speculated, “or a clue dropped to deliberately mislead us.”

“Right. But there’s no way to tell which at this point.”

“You know, it’s impossible for us to position ourselves to intercept a command coming to it. And if the author picks up we’ve accessed the thousand URLs he’s using, he’ll just add thousands more. And we still have no idea of the scope of this thing, how old it is, or what it does.” Jeff paused. “What do you think it does?”

“It can do most anything really, but from what you’ve found it wants to access documents. That tells me it’s snooping.”

“A cyber spy.”

“Exactly. Like a keystroke logger but much better.” Loggers tracked the keys struck on a computer keyboard in a covert manner so that the victim using the keyboard was unaware they were being monitored. The information was then accessed by whoever planted, or had access, to the embedded

logger.

“You know,” Jeff said, “this guy in Geneva might not be lying.”

“If he’s telling the truth, the only way it can be is if someone used this virus to access an OW file in his computer and altered its language before Herlicher sent it with the digital signature attached to it.”

There was silence. They both knew what that meant.

“Get some rest,” Jeff said. “I’m wrapping it up here. The next step is Geneva if they want me, where malware on that end — if it’s still there — might have more clues. I’ll let you know either way. Thanks for your help and thank Frank.”

10

Just as Jeff’s wrap-up meeting was about to begin he received an e-mail from Daryl.

Yates and Walthrop looked hopeful and expectant as they begin. Through the office window beside him, Jeff saw a heavy fog rolling across the city. “This is what I have so far,” Jeff said. “The trail goes to UNOG, as you suspected. I need to access this Herlicher’s computer to be certain and to see if I can learn more about what it’s after.”

Walthrop nodded. “Franz is very upset over this. Between our concerns, his desire to placate me and your reputation, I don’t see a problem with access. I had Graham speak with his counterpart earlier today when it became apparent where this was heading from what Blake told me. They’ve been taking a look at Franz’s computer. There is a greater acceptance of the need to move quickly when it appears digital defenses have been penetrated. Plus, as you saw, this involves Iran’s nuclear program. OFDA at UNOG has a great sensitivity to this. Franz’s superiors already know what has happened and are not happy. It appears the release of their report has been delayed.”

“What is OFDA?” Jeff asked.

“Sorry. The Office for Disarmament Affairs in Geneva. It will source the report. They want nothing to go astray. They are under tremendous pressure.”

He didn’t volunteer why that might be the case and Jeff didn’t ask. “Have there been other incidents since I arrived?” he asked. “These things rarely occur in isolation.”

“Yes,” Yates said. “We’ve had two more computers refuse to execute OW files. Before you ask, one was again from UNOG while the other was from the UN in New York.”

“It’s spreading,” Jeff said. “Here’s what I have. Yes, obviously the problem was caused by a Trojan. It’s brand-new and uses a zero day. That alone makes it stand out. It is also stealthy, utilizing a new and devious technique to conceal itself. It also turns off and on at random, and calls home for instructions in a way I cannot block except by taking it off-line and that’s no systemwide solution.”

“That’s distressing,” Walthrop said.

“Is it targeted to us?” Yates asked.

“I think it is,” Jeff said. “It’s certainly not generic.”

“I see. So what does it do?” Yates asked.

“It’s designed for government espionage, in my opinion,” Jeff said. “At the very least, its purpose is to read your files. And while I have no conclusive evidence, the pointers suggest the government employing it is Iran.” Walthrop visibly reacted to the news but didn’t comment. “As I said, I believe it gives access to content, but…” Jeff hesitated. How to say the rest?

“Yes?” Yates said to encourage him.

“I suspect it allows an outside source to edit documents.”

Walthrop sat up straight in his chair. “What?”

“If it executes and gains access, the interloper can change the contents of an OW document,” Jeff said. “This happens, of course, before the digital signature is applied. The document for all purposes appears genuine. Of course, if the author of the document reviews the copy he sent he’ll catch the changes. That’s unlikely, though. People assume a document is the same as when they last saw it on their computer.”

Walthrop eased back in his chair. “So Franz may be telling me the truth. Let me collect my thoughts on this. You’re saying that this nasty piece of code gives access to our documents and allows them to be altered?”

“Yes,” Jeff said. “That appears to be the case.”

“And I think it’s a genuine document when I receive it?”

“Yes.”

“How long has this been going on?” he asked.

“I can’t say,” Jeff said.

“My God,” Walthrop said. “It may already have read, even altered, thousands of files.” All his fears about computers were coming true. He knew, he just knew, it would come to this someday.

“What else do you have?” Yates asked.

“The clues suggest Iran, as I said. But that could be a plant intended to throw us off. This is a very shady digital world we’re dealing with.”

“I’m curious. Why did my computer have a problem the first time but then opened the file when I tried again?” Walthrop asked. “If Herlicher was infected, his computer had no problem with the virus.”

“I don’t know what security UNOG is using,” Jeff said. “That’s likely the reason. As for the other, my guess is there’s a glitch in the virus. It crashed OfficeWorks the first time you tried but not the second, but in neither case did it successfully activate. I suspect that whoever wrote this code didn’t compensate for at least one of the OfficeWorks security checks.”

“Is there anything more to be done here?” Walthrop asked.

Jeff shook his head. “Blake is perfectly qualified to clean the Trojan out of your computers, if it managed to get onto any of them. He’s got the code and he knows where to look if necessary. I’d say my next stop is UNOG, assuming I’m to continue with this. I still need to write the detection program for you and I need to find out how this thing works. Any virus that’s exploiting a loophole in the digital signature system is a serious threat. But I’d need to access Herlicher’s system to confirm that’s what happened here.”

“We and our counterparts at UNOG are agreed that you should follow up at Geneva,” Yates said. “You can understand this is a potential source of friction between Her Majesty’s government and the United Nations. They are eager to see that possibility eliminated. There’s a Swiss International Air Lines flight leaving at six thirty this evening, which you can just catch. You’ll be in Geneva later tonight. Thank you for your help and we wish you luck.”

11

Franz Herlicher entered his office, glanced about for any signs that someone had been in it while he was gone, saw none, then quietly closed the door before sitting at his workstation. Carlos Estancia, his manager, had summoned him earlier for a quick meeting. Ostensibly it was to inform him that an expert was arriving from London to examine his computer.

Herlicher wasn’t fooled. There was surely more to it than that. There always was. He’d worked for the Spaniard long enough to recognize that look. Estancia thought he had something on him and was just waiting for the so-called expert to give him the cover he needed. UNOG had its own computer people. Hadn’t he been cooperating with them? Who said he wasn’t? Why bring in someone from outside?

Herlicher glanced at his computer. The techs had done some work on it, then abruptly stopped. He’d been told to leave it alone but he couldn’t help wonder what was there to be found. Everywhere he’d browsed was cached away in some electronic recess, at least that was what he understood. He had no taste for pornography and if he had, he counted himself smart enough to know their IT staff would catch him at it at work. It had happened to others. He didn’t squander work hours browsing aimlessly; he knew that was monitored as well. And he certainly never wrote anything disparaging about the UN or the Office for Disarmament Affairs. That was the last thing he’d ever consider.

Estancia had confirmed what the IT people had said, that his computer had been hacked. That was the word he’d used, suggesting by his manner that somehow it was Herlicher’s fault, as if computer security wasn’t a matter for IT. Didn’t they have programs to prevent that sort of thing? Firewalls? They’d been told their Internet security was second to none. Yet, now Estancia was trying to make this his fault.

There was no question of taking this London expert at face value. Something much more significant was taking place. Was he the target? Herlicher wondered, or just a cog in a much bigger game? Was there any way he could know?

Estancia had said nothing about Lloyd Walthrop but it was clear to Herlicher that a document he’d sent the man had been the cause of the problem. The fact that the experts were coming from Britain suggested to him that Walthrop had his own concerns. Shouldn’t that get him off the hook now?

Herlicher couldn’t make sense of the disaster. Estancia, the techs, everyone seemed to be speaking in double-talk. He pressed his hands to his head, feeling one of his migraines coming on. This was all so complicated.

He abruptly straightened with sudden realization. Estancia knew he’d contacted Walthrop about the Iranian report; had been regularly contacting Walthrop. And providing privileged information. There’d been no way to avoid using his office computer for those contacts though they were against policy.

Herlicher turned on his screen and opened his e-mail program. He began systematically deleting every message he’d ever sent Walthrop.

12

Saliha Kaya stood back from the window as she stared at the dark street below. There were few streetlights and most of those no longer functioned.

It was always this way on these trips. Fly from Prague to Ankara, hire a car, drive in one long day to the border with Iran, wait to cross, then check into the hotel. The woman had come and gone. It was done, so why couldn’t she sleep?

It was all exhausting and she didn’t know how many more of these trips she was willing to undertake for Ahmed. The pay was good — not great but good — but the inconvenience was considerable. The flight itself was no problem. She enjoyed airplanes and she often met businessmen who gave her their cards, promising to help her find work wherever it was they lived. She knew what they meant but each card represented an opportunity. Her relationship with Ahmed was going nowhere and every time she went back home, she grew more depressed at the prospect of returning to Turkey.

Her father had died the previous year. Two sisters and a brother still lived at home with her increasingly aging mother. Though her other siblings gave what they could, it fell to Saliha to be the family’s primary support. After all, she lived in the rich West and earned far more than the rest of the family combined.

She’d arrived from Prague in the afternoon, taken a taxi to the apartment where’d she’d grown up, and surprised her family, as she always did. Ahmed had made it clear that she was never to announce her trips to anyone. The girls and her brother were as delighted to see their big sister as she was to see them. She had gifts they excitedly opened and it warmed her to see the happiness she could bring them.

The apartment was on the ground floor and there was a small garden in back. As a child she’d worked it with her grandmother, providing fresh vegetables for the family during the summer and fall. Now that she was gone and her grandmother dead, the garden had turned fallow. With the death of her father, her mother had no time at all to garden. She’d been at the market when Saliha had arrived so she was playing with the children when her mother returned. She smiled warmly and embraced her daughter.

“You are so thin. Don’t you get enough to eat?” she’d said.

Saliha had laughed. “It is the fashion in the West. And I am not so thin as that.” She slipped folded bills into her mother’s hand.

Her mother bowed her head, then said, “Thank you, my daughter. Without you…” The rest she left unspoken.

Yes, without me, Saliha thought. What would the family do? Suffer, go hungry, struggle. Her two sisters would likely be forced into prostitution, her brother be turned into a pimp or thief or both. She knew. She’d seen it enough. She’d escape that fate but would they?

Her older sister was married to a truck driver, the oldest brother worked in Istanbul on the docks. He’d not married so he could give his mother as much of his earnings as possible. To do so he lived in squalor. But the time was approaching when he must look to his own future and begin to save.

That night, Saliha treated the family to foods they normally didn’t enjoy, then helped her mother prepare dinner. Her two sisters had crawled into bed with her, whispering, dreaming until they’d all drifted off. As always it had been a wonderful visit, but too short. These were the best moments of her life.

In Prague, Saliha worked with young women who’d forgotten their families. Money that should have gone home was spent on expensive clothes, a nice apartment, trips. They dressed and behaved like whores and in the process Saliha watched them become hard and bitter. How could anyone turn her back on home? On her family? She didn’t understand it.

Early the next morning Saliha set off to rent a car, telling her mother she’d be back in a few days with more gifts. Her mother stood in the doorway, watching her retreating figure, waving a final time as Saliha turned the corner.

The drive from Ankara to the border with Iran took all of a long, hard day. She drove north and east of Ankara until she joined E80, the Trans-European Motorway or TEM, a divided highway that began somewhere far away in Western Europe and ended just short of the Turkey-Iran border. It crossed the broad Anatolian plain, then wound through long narrow mountain valleys over ancient passes. As she ate up the miles driving at a brisk pace, the true life of so-called modern Turkey unfolded before her. Aged men on donkeys, children herding sheep, exhausted fields struggling to produce one more crop so a family wouldn’t starve. She’d seen it all before and the more time she spent in the West, the more desperate and impoverished her native country looked.

In this region of Turkey, a woman traveling alone was a curiosity. Twice she pulled off the highway to take a short break. When she entered the adjoining small villages she ignored the disapproving looks she received from old men and women, the aggressive stares from young men.

Ahmed had cautioned her to mix up her routine, to take different routes. She’d done that the first three trips and disliked it as any other route took a full, grueling two days. Now she traveled the best and fastest route. The trip was demanding enough without adding his silly rules.

That afternoon as she traveled east, the mountains grew higher, the road become less well maintained and the region more primitive. When she neared the border, she turned down a narrow dirt road. After a short distance she stopped beside a lovely stream lined with poplar trees, shielded from the highway by heavy vegetation. There she opened the car doors and snacked on food prepared by her mother as she listened to the bubbling water. Spring was later here and the air was cool though rich with the fragrance of the mountains. In late summer, the nearby pomegranate trees would be heavy with fruit. Their scent was one of the few pleasures in these trips.

With a glance at her wristwatch, she sighed, went to the car, opened the trunk, then her luggage. She removed a bundle of clothes. She replaced her denims with an ankle-length dark skirt, slipping on a matching long-sleeved parkalike garment. She placed her denims back into the luggage, removed a head scarf, and closed the lid.

She’d scrubbed herself clean before leaving Ankara and wore no makeup, bore no fragrance of any kind. Now she looked like a proper Muslim woman. She’d better.

At sunset, Saliha reached the border with Iran, placing on her head the scarf as she pulled to a stop. She’d traveled often enough to be recognized by the guards. If a single woman driving a car in eastern Turkey was eyecatching, it was even more so in Iran. She’d explained that she was from Prague and that her Iranian boyfriend’s family lived nearby. Whenever she traveled to Turkey he asked her to visit them to give gifts. Then she’d buy some of the things he could only get in Iran and carry them back.

The guards searched the car thoroughly as they always did, even examining the two gifts she’d brought with her from Prague to maintain the charade. After a short delay she was on her way for the final half-hour drive to Maku. It was an ancient capital of the region, today of modest size. Resting in a river valley, it was dominated by a castle.

Here, her instructions never varied. She was to stay only at the Hotel Seyhan Adana and wait. Once that wait had been a short hour, another time she’d sat in her room or the lobby for three days, but always a starkly plain young woman would meet her. This time, early that evening the woman spotted her waiting in the lobby. After brief words of greeting she thanked her for the gifts, gave her items for Ahmed, then took the key-chain drive. That was it.

Back in her room, Saliha carefully opened the packages and meticulously examined the contents. They consisted of regional canned foods unavailable outside Iran. She was not going to be arrested for smuggling. Satisfied they were in order she rewrapped everything, ate a light dinner of rice with a lamb kabob, then found herself pacing in her room unable to sleep. She had another full day of driving ahead of her but sleep just wouldn’t come.

She looked again at the quiet street below. It was full night and almost no one was about. When night descended in Iran an oppressive darkness came with it. She felt like a prisoner in her hotel room.

It was the risk keeping her awake, she realized. She wasn’t stupid. While she had no interest in politics she knew that the Iranian mullahs were at war with the West. She’d considered her boyfriend from every angle and found herself finally reaching the conclusion that he was somehow involved in jihad. It was the one answer that satisfied all her questions. It alone explained his caution, his discreet devotion to Islam, his secret time on his computer, his different cell phones, his private conversations, his mysterious trips, and the thumb drive he gave her for each trip to Iran.

She was smuggling information, something the mullahs didn’t want to have sent to Iran by the Internet or mail, hence a courier.

But what kind of information? What could be so important as to go to all this trouble and expense? She’d spent hours driving here and back trying to solve the enigma. Still she had no idea but she now understood that was the way it was intended to be.

As Saliha prepared for bed, her thoughts wouldn’t turn off. She was in no danger here in Iran, if she was correct, and the Turkish officials, with the nation’s increasingly Muslim orientation, certainly wouldn’t care about what she was doing. If the Czech government really minded, Ahmed wouldn’t have legal status and they’d either expel him or at least be asking questions. She made these trips regularly and had never once been asked about them.

So, she thought as she slipped between the sheets, who was she afraid of?

The CIA for one, but most of all the Mossad, she thought with a shudder. If she was right, either or both of those organizations cared very much indeed about what she was doing and the slightest mistake by someone could point the finger at her.

Saliha feared them both. She didn’t believe for one minute the stories she saw on television or read about a dysfunctional CIA. That was all misinformation. She’d heard about the CIA all her life, how it was behind every coup in the Middle East, every assassination. She had not the slightest doubt. There’d be no Guantanamo for her if the CIA got her. They’d cart her off to some hellhole where torture and rape rooms were stock-in-trade. She had no idea what the Mossad did with people like her but she was certain the CIA alternative was better.

No, she finally decided, this is too much. She knew she must stop this. One more trip and that would be it. And Ahmed must pay well for it.